The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.3, 9.1.8, 9.0.12, 8.4.16, and 8.3.23. This update fixes a denial-of-service (DOS) vulnerability. All users should update their PostgreSQL installations as soon as possible.

The security issue fixed in this release, CVE-2013-0255, allows a previously authenticated user to crash the server by calling an internal function with invalid arguments. This issue was discovered by independent security researcher Sumit Soni this week and reported via Secunia SVCRP, and we are grateful for their efforts in making PostgreSQL more secure.

Today's update also fixes a performance regression which caused a decrease in throughput when using dynamic queries in stored procedures in version 9.2. Applications which use PL/pgSQL's EXECUTE are strongly affected by this regression and should be updated. Additionally, we have fixed intermittent crashes caused by CREATE/DROP INDEX CONCURRENTLY, and multiple minor issues with replication.

This release is expected to be the final update for version 8.3, which is now End-of-Life (EOL). Users of version 8.3 should plan to upgrade to a later version of PostgreSQL immediately. For more information, see our Versioning Policy.

This update release also contains fixes for many minor issues discovered and patched by the PostgreSQL community in the last two months, including:

Prevent unnecessary table scans during vacuuming

Prevent spurious cached plan error in PL/pgSQL

Allow sub-SELECTs to be subscripted

Prevent DROP OWNED from dropping databases or tablespaces

Make ECPG use translated messages

Allow PL/Python to use multi-table trigger functions (again) in 9.1 and 9.2

Fix several activity log management issues on Windows

Prevent autovacuum file truncation from being cancelled by deadlock_timeout

Make extensions build with the .exe suffix automatically on Windows

Fix concurrency issues with CREATE/DROP DATABASE

Reject out-of-range values in to_date() conversion function

Revert cost estimation for large indexes back to pre-9.2 behavior

Make pg_basebackup tolerate timeline switches

Cleanup leftover temp table entries during crash recovery

Prevent infinite loop when COPY inserts a large tuple into a table with a large fillfactor

Prevent integer overflow in dynahash creation

Make pg_upgrade work with INVALID indexes

Fix bugs in TYPE privileges

Allow Contrib installchecks to run in their own databases

Many documentation updates

Add new timezone "FET".

As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shut down PostgreSQL and update its binaries. Users who have skipped multiple update releases may need to perform additional, post-update steps; see the Release Notes for details.